Legal
Privacy Policy
How AIGMS™ handles personal information when you visit aigms.uk, use the AIGMS™ Adviser, submit forms or buy a digital product.
1. About this notice
This notice explains how personal information is handled when you visit aigms.uk, use the AIGMS™ Adviser, request a resource, send an enquiry, submit an initial Founding Verification Cohort application, use an account or buy a digital AIGMS™ product.
Personal information is handled in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 as amended.
2. Controller and contact
The controller responsible for the personal information described in this notice is:
Controller: Pashenka Beddar
Email: privacypolicy@aigms.uk
Website: https://aigms.uk
AIGMS™ — correspondence (mail only)
Hardwick House
No. 2 Agricultural Hall Plain
Norwich
Norfolk
NR1 3FS
Please use the privacy email above for questions, rights requests or concerns about how your information is handled. This is a correspondence address for business mail only. It is not a customer-facing office and we do not accept visitors at this address.
3. Information collected
3.1 Free guide requests
The free guide form asks for your first name, last name and email address. You may also provide a company name. The form records limited page and submission information which is needed to deliver and administer the request.
3.2 Enquiries and initial Founding Verification Cohort applications
The contact form asks for your first name, last name, company name, email address and message. You may also provide a website address. It records your acknowledgement of this Privacy Policy. A separate optional checkbox records whether you have agreed to receive occasional AIGMS™ updates, resources and marketing email.
The initial Founding Verification Cohort application asks for the authorised representative's name, job title and work email. It also asks for the applicant's legal business name, trading name, company registration details where applicable, principal business address, website, sector, proposed scope, AIGMS™ version, operating dates, number of Active AI Activities, highest Consequence Rating, Assurance Review position and external implementation support relationship. It records the applicant confirmations and acknowledgement of this Privacy Policy.
The initial application collects summary information for recruitment and administrative screening only. It does not accept governance evidence, payment details, confidential evidence links, special category personal data or credentials. Application information is not used for marketing unless separate marketing consent has been given.
Please do not include passwords, payment card details, health information, personal information about other people or other sensitive information in a message or initial application unless it is necessary and you have been asked to provide it through an approved secure route.
3.3 Purchases, billing and digital delivery
When you make a purchase the shop may collect your email address, name, country, billing address, town or city and postcode. You may provide a telephone number or order note. The shop also creates order, payment-status, receipt and download-entitlement records needed to complete the purchase, administer the licence and support the named purchasing legal entity.
Fields marked as required at checkout are needed to enter into and perform the purchase contract. If you do not provide them the shop cannot process payment, issue the receipt, deliver the downloads or administer the licence. Fields not marked as required are optional.
3.4 Payments
Stripe provides the payment interface. Payment card details are submitted to Stripe and are not stored on this website. AIGMS™ may receive information such as payment status, transaction reference, payment method and fraud or authentication results which are needed to administer the order.
3.5 Accounts and authentication
If you use an existing customer account the site processes your username or email address, password credentials, login status and any choice to remain signed in. Passwords are stored in protected hashed form rather than readable text. Account and download history may be used to provide ongoing access to purchases.
3.6 Technical and security information
The website host, content-delivery service and security tools may process IP addresses, timestamps, requested pages, browser or device information, referring pages, login events and security indicators. This information supports delivery of the website, fault diagnosis, access control, fraud prevention and investigation of suspected misuse.
3.7 AIGMS™ Adviser
The AIGMS™ Adviser is an automated website assistant which provides information about AIGMS™, its products, implementation and the developing Verification Programme. When you use it, the website processes the message you type, recent conversation context needed to keep the exchange coherent and a random temporary browser-session identifier used for rate limiting and abuse prevention.
The Adviser sends the message and relevant recent conversation context to the OpenAI API so that a response can be generated from the approved AIGMS™ knowledge base. Requests are configured with response storage disabled. AIGMS™ does not intentionally use the Adviser to create a permanent chat history in the WordPress database. Recent conversation context is held temporarily in the open webpage while you use the Adviser.
OpenAI states that API inputs and outputs are not used to train its models by default. OpenAI may retain API customer data for up to 30 days for service and abuse-monitoring purposes, subject to its applicable terms and any legal requirement to retain data for longer.
Please do not enter sensitive or confidential information into the AIGMS™ Adviser. Do not submit passwords, access credentials, special-category personal data, detailed incident records, legal records, confidential governance evidence or personal information about other people.
3.8 Information received from other sources
Payment and fraud-prevention providers may return transaction, authentication and risk information. Hosting and security providers may provide alerts or logs about suspected attacks. Personal information is not purchased from data brokers.
4. Purposes and lawful bases
| Purpose | Information used | Lawful basis |
|---|---|---|
| Send a guide you requested | Name, email address, optional company name and submission information | Legitimate interests in responding to your request and providing the resource |
| Respond to an enquiry | Contact details, organisation, website and message | Legitimate interests in handling enquiries. Contract may apply where you request specific steps before a purchase or where the enquiry concerns an existing order |
| Provide the AIGMS™ Adviser and package guidance | Message content, recent conversation context, temporary session identifier and limited technical/security information | Legitimate interests in answering requested AIGMS™ questions, helping visitors understand products and protecting the service from misuse |
| Handle an initial Founding Verification Cohort application | Authorised representative details, applicant identity and address, website, sector, proposed scope, AIGMS™ operating summary, Assurance Review position, external support relationship and applicant confirmations | Legitimate interests in checking completeness, considering cohort eligibility and responding about the application |
| Process an order and deliver digital products | Identity, contact, billing, order, payment-status and download information | Contract |
| Keep accounting, tax and transaction records | Order, invoice, payment and refund information | Legal obligation |
| Administer licences, entitlements and customer support | Purchasing entity, order, product, entitlement, download and correspondence information | Contract |
| Protect the website, customers and services | Technical logs, IP address, authentication, security and transaction-risk information | Legitimate interests in providing a secure service, preventing fraud and defending legal rights |
| Send optional marketing | Name, email address, organisation, consent record and communication history | Consent |
Where legitimate interests are used the purpose, necessity and effect on your rights are considered. You may object where this lawful basis applies.
5. Sharing and service providers
Personal information is not sold or rented. It may be shared only where necessary with the following recipients:
| Recipient | Why information is shared |
|---|---|
| Stripe and Klarna where selected | Payment processing, authentication, fraud prevention, refunds and disputes. Klarna receives information only where you choose that payment method and it is offered at checkout |
| Website hosting, content-delivery and security providers | Hosting, secure delivery, backups, threat detection, logging and technical support |
| Email delivery and mailbox providers | Delivering the guide, sending order messages and responding to enquiries |
| OpenAI API | Processing AIGMS™ Adviser messages and recent conversation context to generate knowledge-grounded responses. AIGMS™ uses the API rather than a consumer ChatGPT account |
| Google Fonts | Supplying website fonts. Google may receive connection information such as an IP address and browser request details when a font is requested |
| Accountants, insurers, legal advisers and other professional advisers | Professional advice, accounting, insurance, disputes and legal claims |
| Courts, regulators, law-enforcement bodies or public authorities | Where disclosure is required or permitted by law |
Stripe may act as a processor when it provides payment services on AIGMS™ instructions. It may act as a controller for its own regulatory, fraud-prevention and legal-compliance activities under its privacy information.
OpenAI processes AIGMS™ Adviser API data to provide the requested AI service under its business/API arrangements. OpenAI states that API inputs and outputs are not used to train its models by default unless the customer expressly opts in to data sharing.
Providers are given only the information reasonably needed for their role. AIGMS™ requires appropriate contracts, access controls and other safeguards where the law requires them.
6. International transfers
Some providers may process personal information outside the United Kingdom. This can include Stripe and Google plus their affiliates or service providers. AIGMS™ requires an applicable UK adequacy regulation or another recognised safeguard where the law requires one.
Providers describe their processing locations and safeguards in their own privacy information. Further information is available in the Stripe Privacy Centre and the Google Privacy Policy. You may contact privacypolicy@aigms.uk to ask about a relevant transfer safeguard.
7. Retention
Information is kept only for as long as needed for the stated purpose, legal requirements and the establishment or defence of legal claims. The usual periods are:
| Record | Usual period |
|---|---|
| Free guide request | Up to 30 days after successful delivery. If separate marketing consent is given only the minimum marketing profile and consent evidence move to the marketing records |
| Contact enquiry or initial Founding Verification Cohort application | Up to 12 months after the enquiry or application closes or the last meaningful contact |
| AIGMS™ Adviser message and recent chat context | AIGMS™ does not intentionally create a permanent WordPress chat history. Recent conversation context lasts in the open webpage while the Adviser is being used. OpenAI may retain API customer data for up to 30 days under its applicable API data-retention terms, except where law requires longer retention |
| Marketing profile | Until consent is withdrawn or after 24 months without meaningful interaction. A minimal suppression record may be kept so an opt-out is respected |
| Marketing consent evidence | While marketing continues and normally up to six years after the final communication or withdrawal |
| Completed or refunded order, receipt and payment reference | Normally up to seven years from the transaction to support accounting, tax, refund and legal requirements |
| Minimal licence and entitlement record | For as long as the licence or entitlement is active and normally up to six years afterwards |
| Detailed download-event logs | Normally up to 12 months unless an abuse investigation or legal hold requires longer |
| Pending or abandoned order | Seven days |
| Failed order | 30 days |
| Cancelled order | 90 days where no payment, invoice, download or dispute remains |
| Customer account | While required for purchases or download access and normally up to 24 months after the last relevant activity |
| Routine email copies | Normally up to 12 months after an enquiry closes. Transaction messages follow the order period and dispute messages follow any applicable legal hold |
| Routine security and access logs | Normally up to six months. Incident evidence may be retained longer where necessary |
| Website and database backups | Kept on a rolling schedule and normally overwritten within 90 days |
A record may be held longer where a tax enquiry, chargeback, complaint, fraud investigation, security incident, insurer requirement or legal claim requires a documented hold. Information is deleted or anonymised when the applicable period ends. Processors must follow AIGMS™ instructions. A provider acting as a separate controller may retain records that it needs for its own legal obligations under its privacy notice.
9. Marketing
Requesting the free guide does not subscribe you to marketing. Marketing email is sent only where you use the separate optional consent box.
You may withdraw marketing consent at any time through an unsubscribe option or by emailing privacypolicy@aigms.uk. Withdrawal does not affect processing which took place before withdrawal. A minimal suppression record may be retained to prevent further marketing.
10. Your rights
Your rights depend on the circumstances and lawful basis. They may include:
Send a request to privacypolicy@aigms.uk. Identity may need to be confirmed before information is disclosed. A response will normally be provided within one month. This may be extended where the law permits and you will be told if that happens.
11. Security
Reasonable technical and organisational measures are used to protect personal information. These include encrypted HTTPS connections, access controls, multifactor authentication for administrative services where available, security monitoring, malware protection, supported software and security updates.
No online service can guarantee absolute security. Where a personal-data breach occurs it will be assessed, documented and reported to affected people or the Information Commissioner's Office where the law requires it.
12. Automated processing
The AIGMS™ Adviser uses automated processing to generate written answers and may recommend a Foundation, Operating or Assurance product based on information you choose to provide. The recommendation is AIGMS™ product guidance, not an independent assessment, and you decide whether to follow it. It does not itself create a contract, grant Verification or produce a legal or similarly significant decision about you.
Stripe and a chosen payment-method provider may use automated checks based on transaction, authentication, device and fraud indicators. A check may approve a payment, request additional authentication, refer it for review or refuse it. AIGMS™ does not otherwise use personal information to make solely automated decisions which produce legal or similarly significant effects. Contact AIGMS™ if you believe a payment decision requires review or you need an alternative way to pay.
13. External links and children's information
The website may link to third-party sites which have their own privacy notices. AIGMS™ is not responsible for how those independent sites handle information.
The website and products are intended for organisations and adults. Personal information is not knowingly collected from children. If information relating to a child is received unintentionally please contact privacypolicy@aigms.uk so it can be reviewed and removed where appropriate.
14. Changes to this notice
This notice will be reviewed when website functions, suppliers or legal requirements change and at least annually. The effective date and version will be updated when changes are published. A material new use of personal information will be brought to affected people's attention where required.
15. Complaints and contact
Please contact privacypolicy@aigms.uk first if you have a question or concern. You also have the right to complain to the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint
